tcpflow Out-of-Bounds Read via Forged IP Payload Length

Executive Summary

CVE-2026-119600 is an out-of-bounds read vulnerability in tcpflow version 1.6.1. It occurs when tcpflow processes crafted IPv4 or IPv6 TCP packets with forged payload lengths. The tool reads the payload length directly from packet headers without verifying the actual captured data length, causing it to read past the end of the buffer. This can leak adjacent process memory or crash the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor tcpflow processes for crashes or unusual memory usage when processing network traffic. Check for out-of-bounds reads by analyzing tcpflow logs or core dumps. Use tcpdump to capture suspicious packets and inspect them with tools like Wireshark for forged IP payload lengths.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by sending malicious packets to a system running tcpflow. This may lead to information disclosure (reading process memory) or denial-of-service (crashing tcpflow). The attack requires no authentication and can be carried out via live traffic or crafted pcap files.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade tcpflow to a patched version if available. If not, disable tcpflow or restrict its use to trusted network traffic. Monitor system logs for crashes or memory leaks. Consider using alternative tools like tcpdump or Wireshark for network analysis until a fix is released.

Useful 0 Not Useful 0